DEPARTMENT OF BUSINESS AND PROFESSIONAL REGULATION RICK SCOTT Governor KEN LAWSON Secretary MELINDA M. MIGUEL Chief Inspector General LYNNE T. WINSTON, Esq., CIG Inspector General Office of Inspector General Audit Report A-1415BPR-020 Audit of Processor-Approved Applications within the Division of Certified Public Accounting December 2015
Department of Business and Professional Regulation OFFICE OF INSPECTOR GENERAL AUDIT OF PROCESSOR-APPROVED APPLICATIONS WITHIN THE DIVISION OF CERTIFIED PUBLIC ACCOUNTING EXECUTIVE SUMMARY This audit was conducted in accordance with the Office of Inspector General s Fiscal Year 2015-16 Annual Audit Plan. The Director of the Division of Certified Public Accounting (division) requested that we evaluate division procedures for the approval of applications for licensure by division processors. The Director s primary concern was that division processors exercise broad approval authority with limited supervisory review. Accordingly, our overall audit objective was to evaluate the sufficiency and effectiveness of the internal controls governing the approval process. Although laws and rules governing the accountancy profession in Florida establish stringent requirements for accountancy practitioners, the division has limited internal controls over the approval of applications for CPA examination or licensure. We therefore sought to determine whether processors obtained and appropriately evaluated all required documentation for a sample of approved applications, and whether the approval decision appeared to be accurate based on the supporting documentation in OnBase and Versa: Regulation. While we did not identify any applications that were approved in error, we did identify processing errors and instances in which the approval decision was not clearly substantiated. We identified similar processing errors in our analysis of issues escalated to the division for response during the period from January 1 to June 30, 2015. We also reviewed results of quality assurance reviews performed by the Division of Service Operations and found that such reviews are useful in identifying applications approved in error and other processing errors. We concluded the division could enhance its internal controls by establishing a similar quality assurance process. To help ensure consistency and accuracy in the processing and approval of accountancy applications, we recommend the Division of Certified Public Accounting conduct quarterly quality assurance reviews of a sample of processor-approved applications. ACKNOWLEDGEMENTS We would like to acknowledge the cooperation, assistance, and input provided to us by the management and staff of the Division of Certified Public Accounting and in particular, the management and staff of the Application Processing Section. We appreciate the time spent with us in interviews and observations and the timely response to our requests for supporting documentation. INTRODUCTION AND BACKGROUND Chapter 473, Florida Statutes, establishes the statutory basis for the regulation of public accountancy in Florida. The chapter creates the Board of Accountancy within the Department of Business and Professional Regulation (DBPR, department) and provides that every certified public accountant and firm shall be governed and controlled by the chapter and the rules Office of Inspector General Page 1
adopted by the board. The chapter further requires the Division of Certified Public Accounting (division) to provide all services of the chapter and of Chapter 455, Florida Statutes, necessary to regulate the practice of public accountancy. The mission of the Division of Certified Public Accounting is to promote consumer protection by ensuring that certified public accountants and firms meet and adhere to the statutory requirements for licensure. The division is responsible for the licensing of more than 32,000 active and inactive Certified Public Accountants (CPAs) and more than 5,000 firms. The division also provides administrative support to the nine-member Board of Accountancy. The board makes final decisions in areas that affect the practice of public accounting. The division s organizational structure includes the Director s Office and three sections: Application Processing, Enforcement, and Legal. The Application Processing Section is responsible for processing applications to sit for the CPA examination and applications for individual and firm CPA licensure. The section also processes applications for refunds and licensure maintenance requests, conducts background checks on all individual examination and licensure applications, and serves as the liaison to the CPA Examination Services of the National Association of State Boards of Accountancy (NASBA). The section is staffed by three application processors and a section supervisor. RESULTS Issue: The Division of Certified Public Accounting has few internal controls over the approval of applications by division processors. Division processors have broad authority to approve examination and licensure applications. Processors may not deny an application. They may recommend that the Board of Accountancy deny an application and in such cases, the applications are submitted for board review. However, the board does not review processor-approved applications. Further, division management does not routinely review approved applications to verify that applicants have met all required elements. The primary control over the approval process consists of written procedures that provide processors information and guidance on the requirements for each type of application and general directions on how to process the application. Due to the highly regulated nature of Florida s accountancy profession, division processors must have in-depth knowledge and understanding of the state laws and rules associated with each type of application. Overview of Licensure Requirements Applicants to sit for the CPA examination must provide official transcripts showing achievement of specific educational requirements, including the completion of 120 semester hours from an accredited college or university (unless using rule provisions for study at an unaccredited institution). The applicant must have completed 24 semester hours of upper division accounting with coverage in specific areas, such as taxation, auditing, cost accounting, etc. The applicant s business education program must include 24 semester hours of upper division general business courses (although certain lower division courses are acceptable). Applicants are further required to have completed six semester hours of business law courses, which must cover contracts, torts, and the Uniform Commercial Code. Office of Inspector General Page 2
Applicants for original CPA licensure must have passed all parts of the CPA examination within an 18-month rolling period and apply for licensure within three years of passing the last part of the CPA exam. Applicants must have completed 150 semester hours of college education, including a baccalaureate degree or higher with a major in accounting, or its equivalent. The applicant must have completed a total of 36 semester hours of upper division accounting and 39 semester hours of general business courses. Applicants must also provide evidence of 1 year of work experience or service involving the use of accounting, tax, attest, and/or other specified skills. Such work experience must be verified by a licensed CPA. Applicants for licensure by endorsement must provide documentation of their education and work experience, and submit an Authorization for Interstate Exchange of Examination and Licensure Information Form from each state board of accountancy in which the applicant had been previously licensed or had sat for the CPA exam. Among other requirements, applicants for license reactivation must also document achievement of required Continuing Professional Education (CPE) hours. Overview of Application Processing Processors review the documentation submitted with each application and advise the applicant by letter of any noted deficiencies, such as incomplete applications or forms, or missing supporting documentation (transcripts, verification of work experience, etc.). Processors also advise applicants of deficiencies related to education or CPE requirements. In reviewing transcripts, processors must ensure the applicant has achieved the appropriate number of hours and course content at the appropriate academic level. They must also ensure that courses covering a substantially equivalent professional area of knowledge are counted only once. Division staff enters application data and information in Versa: Regulation (VR), including information related to steps in the review process. The application and supporting documents are maintained in OnBase, including copies of deficiency letters and other correspondence, and the Education Worksheet completed by the division processor. The worksheet documents the results of the processor s transcript review and identifies any education deficiencies. To ensure compliance with the CPE requirements for endorsement and reactivation applications, the processor completes a Continuing Professional Education Reactivation Reporting Form. Division Workload and Sample Selection Table 1 shows the number of applications the division received in Fiscal Year 2013-14 by type of application: Table 1 Applications Received in Fiscal Year 2013-14 Application Type Number Percent Request CPA Examinations 2,462 49.8% Original CPA Licensure 824 16.7%` Licensure by Endorsement 723 14.6% Accountancy Firms 506 10.2% Reactivation 225 4.6% Temporary Permits 192 3.9% Ethics- Continuing Education Sponsors 13 0.3% Total 4,945 100.0% Office of Inspector General Page 3
For the purposes of this audit, we focused on the four application types that make up the majority of applications and that require a more extensive level of review by division processors, as follows: Request for CPA Examinations Original CPA Licensure Licensure by Endorsement Reactivation We obtained a master list from the Division of Technology of all applications the division received in calendar year 2014 (January 1, 2014 through December 31, 2014). We then compiled a subset of applications approved by the division s three processors in 2014 for the four application types noted above. From this list, we selected a random sample of 50 applications from the 2,106 applications in our data set. This sample contained the following number of applications, by application type. Table 2 Sample Population Application Type Number Percent Request for CPA Examination 22 44% Original CPA Licensure 13 26% Licensure by Endorsement 8 16% Reactivation 7 14% Total 50 100% Analysis: Application Processing For each application in our sample, we compared the application information in Versa: Regulation (VR) with the supporting documentation in OnBase to determine whether the processor had reviewed all required documents and whether the documentation appeared to support the processor s approval decision. We also reviewed the VR records to determine whether the VR data and information appeared to support the approval decision. For example, examination information is maintained in VR but not in OnBase. We further compared VR and OnBase data and information to verify the accuracy of the VR records. Our review of a sample of 50 application files did not identify any applications approved in error. However, we concluded the division would benefit from a quality assurance process to help ensure that applications were approved in accordance with all requirements, that the application data and information in VR is accurate and complete, and that the OnBase and VR supporting documentation substantiates the approval decision. We found that in some cases, the approval decision was not clearly substantiated. In one case, the Education Worksheet was missing from the application file in OnBase. We therefore could not verify that a processor had reviewed the applicant s transcripts. In many instances, the basis for removing education or CPE deficiencies was not apparent from the Education Worksheets or CPE reporting forms alone. After reviewing additional or subsequent transcripts, processors did not consistently initial the revised worksheet, provide the date of its revision, or indicate which deficiencies they had cleared. In these cases, it was not Office of Inspector General Page 4
evident from the worksheet that any deficiencies had existed. We therefore reviewed the applicant s transcripts or CPE documentation to verify that the applicant had met all education requirements. In addition, processors did not generally include explanatory information on the worksheets and reporting forms or make notations in VR to document the steps in their review. The worksheets and VR records therefore did not provide clear evidence that a processor had reviewed additional transcripts or other required documentation, or had removed a deficiency due to data entry or other error. Clear documentation of the basis for removing deficiencies would provide greater assurance that the application was appropriately approved. When approving applications for initial CPA Licensure, processors carry forward the existing Education Worksheet from the application for CPA examination and do not reevaluate prior coursework. Approving an application in error at the examination stage thus compounds the risk that an applicant does not meet all requirements for initial CPA licensure. We identified one instance in which the supporting documentation for initial licensure did not substantiate the approval decision. We determined the processor had relied on a transcript submitted as part of the applicant s request to sit for the CPA examination. This instance illustrates the need for additional documentation of the basis for approving the application. A quality assurance process is intended to identify such issues. In cases where the Board of Accountancy had approved applications for criminal history only, processors frequently did not document such approval in either OnBase or VR. 1 Similarly, processors frequently did not maintain a complete application record in the VR tracking module. Processors use VR to track application deficiencies, such as missing documents, incomplete forms, required coursework, etc. They also use VR to track the date each deficiency was cleared. Comparison of the OnBase documentation and VR record showed that processors did not enter all deficiencies into VR for tracking purposes or record the clearance of all deficiencies in the VR tracking module. We therefore concluded the VR data could not be relied upon to verify that all deficiencies were cleared prior to the application approval date. Further, the VR data is used to track the number of days taken to approve an application. State law requires the department to approve or deny applications within 90 days of receipt of a completed application. Failure to record deficiencies in the VR tracking module may result in overstating the number of days taken to approve the application. Alternatively, failure to record the date the division received required documents or the date the processor cleared a deficiency, may result in understating the number of processing days. We also identified data entry errors in VR. Comparison of the OnBase and Versa: Regulation application files showed two instances in which the date of receipt stamped on the application did not match the received date in VR. We also identified other inaccuracies in the VR application record, such as errors in applicant names, addresses, and other demographic information. Such errors present difficulties for the applicant. For example, the name an applicant provides to the CPA examination provider must match the name of record maintained in VR. We also identified misspelled names and incorrect addresses in division correspondence generated from VR. 1 Applications with certain criminal histories are submitted to the Board of Accountancy. The board considers the circumstances and may deny the application or approve the application for criminal history, only. If approved for criminal history only, the application is then returned to the division for processor review and approval. Office of Inspector General Page 5
Analysis: Escalations As described above, applicants submit extensive information and documentation to demonstrate they have met all education, work, and other licensure requirements. The degree of difficulty processors encounter when reviewing applications was underscored in our review of the 771 issues that were escalated to the division during the period January 1 to June 30, 2015. 2 Our review found that 49 (6.4%) of the escalations involved errors in transcript review or data entry. In 26 (3.5%) instances, the escalation resulted in a division processor reducing all or part of an applicant s educational deficiency. In 22 (2.9%) cases, the escalation required a processor to correct a demographic error in Versa: Regulation. In many of these instances, applicants reported they were unable to register for the CPA examination due to an error in the name, social security number, or birth date recorded in VR. Benefits of a Quality Assurance Process We concluded the state s minimum competency requirements create a level of complexity that warrants additional internal controls over the approval of licensure applications. Use of quality assurance reviews would assist the division in reducing the potential for applications approved in error. A quality assurance process would also promote greater consistency in how processors interpret and apply licensure requirements. Finally, management review would help ensure that processors appropriately document their approval decisions in OnBase and Versa: Regulation. In comparison to the Division of Certified Public Accounting, applications processed by the Bureau of Central Intake and Licensure (CIU) are reviewed by the Division of Service Operations Quality Assurance Team. The Quality Assurance Team evaluates approximately 3% of the applications the CIU processes each month to verify that: The application data entered into VR was correct, including name, address, date of birth, social security number, telephone number, email address, etc. All data associated with processing the application was entered correctly and that all deficient items were cleared correctly in VR. The processor had identified all deficiencies, and if a deficiency was identified, the processor provided effective guidance to the applicant. For approved applications, the Quality Assurance Team further verifies that the applicant had met all requirements for initial licensure. Data provided by Division of Service Operations management showed that during the first six months of calendar year 2014, the Quality Assurance Team reviewed 4,034 applications and identified an overall 3% error rate in application processing. The team determined that in 13% of cases, processors did not identify all deficiencies, and in 15% of cases where processors did identify deficiencies, they did not provide effective guidance to the applicant. Further, 5.4% of approved applications did not meet all requirements for initial licensure. The results reported by the Division of Service Operations support our conclusion that a quality assurance process would also benefit Division of Certified Public Accounting management. Review of a sample of approved applications would assist division management in assuring consistency and accuracy in the division s application review and approval process. 2 When the department s Customer Contact Center needs assistance in responding to customer questions or issues, the matter is escalated to the appropriate division for resolution. Office of Inspector General Page 6
RECOMMENDATION We recommend that Division of Certified Public Accounting management review a sample of processor-approved applications each quarter to verify that applications were approved in accordance with all requirements, that the application data and information in Versa: Regulation is accurate and complete, and that the supporting documentation in OnBase and Versa: Regulation substantiates the approval decision. MANAGEMENT S RESPONSE Management of the Division of Certified Public Accounting concurred with the audit finding and recommendation. The full text of the division s response is appended. Objective OBJECTIVES, SCOPE AND METHODOLOGY The overall objective of this audit was to evaluate the sufficiency and effectiveness of internal controls over the approval of applications for licensure by Division of Certified Public Accounting processors. Scope The audit scope included a review of Division of Certified Public Accounting operations, records, and activities related to the processing of licensure applications for the period January 1, 2014 through December 31, 2014 and selected records and information for prior and subsequent periods, as necessary. Audit testing was limited to review of operations, records, and activities associated with the processing of requests for CPA examinations, and applications for initial CPA licensure, licensure by endorsement, and license reactivation. Methodology To accomplish our audit objective we reviewed relevant statutes and rules, including Chapter 473, Florida Statutes, and Chapters 61H1-19 through 61H1-39, Florida Administrative Code. We also reviewed the applications and instructions for completing the application for each type of application included in our review. Audit procedures and tests also included, but were not limited to, the following: Reviewed Division of Certified Public Accounting, Licensing Procedure Manual (as revised October 31, 2014) and other written procedures for application review and processing. Interviewed Division of Certified Public Accounting management and Application Processing Section management and staff concerning the division s internal controls for application review and approval. Reviewed and performed testing of a sample of 50 applications approved by Division of Certified Public Accounting Application Processing Section staff during calendar year 2014. Office of Inspector General Page 7
Reviewed and analyzed issues escalated to the Division of Certified Public Accounting for the period January 1, 2015 through June 30, 2015. Reviewed activities and operations of the Division of Service Operations, Bureau of Central Intake and Licensure (CIU) Quality Assurance Team and interviewed Division of Service Operations management concerning the quality assurance process. Reviewed and analyzed Quality Assurance Team results reported for the period January 1, 2014 through June 30, 2014. STATEMENT OF ACCORDANCE This review was conducted pursuant to Section 20.055, Florida Statutes, and in conformance with the Principles and Standards for Offices of Inspector General as published by the Association of Inspectors General and the International Standards for the Professional Practice of Internal Auditing as published by the Institute of Internal Auditors, Inc. These standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for the findings and conclusions presented herein. The mission of the Department of Business and Professional Regulation is to: License efficiently. Regulate fairly. The Office of Inspector General is established pursuant to Section 20.055, Florida Statutes, to provide a central point for the coordination of and responsibility for activities that promote accountability, integrity, and efficiency in government. The mission of the Office of Inspector General is to be a valuable partner in conducting independent, objective internal audits, reviews, and investigations of department activities and programs. This review was conducted by Steven Henry, CIGA, CGAP, Senior Internal Auditor, under the supervision of Sandra L. Lipner, Director of Auditing. This and other reports prepared by the Office of Inspector General of the Department of Business and Professional Regulation can be obtained by telephone (850-414-6700) or by mail (1940 North Monroe Street, Tallahassee, FL 32399-1018). Office of Inspector General Page 8
DIVISION RESPONSE